{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-70558 in the wild and no public exploit code.","fix":"No fix has been published for CVE-2026-70558 yet. Limit exposure of the affected software until one is available.","what":"CVE-2026-70558 is a critical vulnerability in DataLinkDC Dinky, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-70558 and fix it if it is affected.\n\nWhat it is: CVE-2026-70558 is a critical vulnerability in DataLinkDC Dinky, published on 6 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-70558 in the wild and no public exploit code.\n\nAffected product: DataLinkDC Dinky. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-70558/ (Markdown: https://insights.sbomify.com/CVE-2026-70558/index.md)","id":"CVE-2026-70558","markdown":"https://insights.sbomify.com/CVE-2026-70558/index.md","name":"CVE-2026-70558","record":{"aliases":["GHSA-2p66-w3p3-5226","GHSA-7crv-rq8j-wxc3"],"analysis":{"component_type":"web_application","fix_type":"patch","impacts":["code_execution","account_takeover"],"network_reachable":"yes","non_default_config":false,"product_category":"Dinky data platform","requires_auth":"none","summary":"Attackers can write arbitrary files using a hardcoded default token, leading to remote code execution or admin session hijacking in Dinky deployments.","user_interaction":"not_required","vuln_class":"file_upload"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"VulnCheck","cpe":[],"cvss":{"score":9.3,"severity":"critical","source":"cna","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","version":"4.0"},"cwes":[{"id":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type"}],"description":"Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation. The route is marked @SaIgnore and /download/** is excluded from the Sa-Token interceptor, so the only guard is a header equality check against a dinkyToken value whose default (efda1551-7958-4e0f-80a8-dfd107df3e38) is hardcoded in source and shipped to every deployment. Anyone who can reach Dinky's HTTP port (8888 by default) and supplies the hardcoded token can write arbitrary files as the Dinky service account. The default Docker image runs on 8888 with no proxy or authentication and chmod 777 on /opt/dinky, so the application's own classpath, launch scripts, and static assets are writable. Demonstrated impact: overwriting /opt/dinky/config/static/index.html served attacker JavaScript to admin browsers immediately, and writing /opt/dinky/org/dinky/Dinky.class executed attacker code as the Dinky service account at the next JVM start via a classpath-shadow launched by script/bin/auto.sh. Writes are uid 9999 (flink), not root, so /etc, /root, /home, and /usr are refused. Affects Dinky v1.2.5 (the current release) and the development branch, where the code is byte-identical.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":false,"headline":"Dinky Unauthenticated Arbitrary File Write via /download/uploadFromRsByLocal Gated Only by Hardcoded Default Token","id":"CVE-2026-70558","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"file_upload","year":"2026"},"n_packages":0,"n_references":3,"next":{"headline":"Dinky Unauthenticated System Configuration and Credential Disclosure via GET /api/sysConfig/getAll","id":"CVE-2026-70559"},"packages":[],"prev":{"headline":"diboot-core Authenticated Arbitrary Field Read via loadRelatedData Discloses Password Hashes and Salts","id":"CVE-2026-70557"},"products":["Dinky"],"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-14","vendors":["DataLinkDC"]},"summary":"Attackers can write arbitrary files using a hardcoded default token, leading to remote code execution or admin session hijacking in Dinky deployments.","url":"https://insights.sbomify.com/CVE-2026-70558/"}